OpenAI hires reverse-engineering veteran Halvar Flake for cyber and efficiency work

OpenAI has hired Thomas Dullien, known as Halvar Flake, to work on cybersecurity and computing efficiency, starting August 10th. Dullien, a renowned reverse-engineering veteran and co-founder of zynamics and Optimyze, will bring expertise in vulnerability research and software efficiency to OpenAI's expanding cyber-defense efforts, which include the Codex Security agent and the Daybreak operation.

Thomas Dullien, better known as Halvar Flake @halvarflake https://x.com/halvarflake , will join OpenAI https://openai.com/about/ on Monday, August 10th, to work on cybersecurity and computing efficiency. Dullien disclosed the move in an August 4th post on X https://x.com/halvarflake/status/2084606631627653200?s=46 , describing his remit as "better cyber" that would also involve "efficiency work." He did not identify a formal title or specific OpenAI product. Dullien gives OpenAI an unusual combination of vulnerability research, low-level systems work and experience turning both disciplines into acquired software companies. He began reverse engineering software as a teenager and later became known for research on Windows heap exploitation, patch diffing and binary analysis. In 2004, he founded zynamics, which built tools including BinDiff, BinNavi and VxClass before Google acquired the company in 2011. thomasdullien.github.io https://thomasdullien.github.io/about/?utm source=openai After the acquisition, Dullien spent several years at Google and worked with Project Zero https://projectzero.google/2018/12/searching-statically-linked-vulnerable.html from 2016 through the end of 2018. His research there included techniques for finding vulnerable statically linked library functions inside executable code, a problem that sits close to the automated code analysis OpenAI is pursuing through its security products. projectzero.google https://projectzero.google/2018/12/searching-statically-linked-vulnerable.html?utm source=openai Dullien left Google in January 2019 to co-found Optimyze, a continuous-profiling software maker built around identifying where large Linux fleets consume CPU cycles. Optimyze's founding thesis was that slowing improvements in processor performance and the shift toward cloud computing would make software efficiency a direct infrastructure-cost issue. Elastic agreed to acquire Optimyze https://www.elastic.co/about/press/elastic-and-optimyze-join-forces-to-deliver-continuous-profiling-of-infrastructure-applications-and-services in October 2021 and completed the transaction the following month. elastic.co https://www.elastic.co/about/press/elastic-and-optimyze-join-forces-to-deliver-continuous-profiling-of-infrastructure-applications-and-services?utm source=openai That background explains why Dullien paired cyber and efficiency in the same short announcement. OpenAI is spending heavily on models capable of performing longer, tool-driven software tasks, while also turning those models toward vulnerability discovery, exploit validation and patch generation. Dullien has worked on both sides of that equation: identifying how software fails and measuring where large production systems waste computing resources. The hire comes during a rapid expansion of OpenAI's security work. OpenAI introduced Aardvark, an agent for finding and patching software vulnerabilities, in October 2025 and renamed it Codex Security in March 2026. In June, OpenAI placed Codex Security alongside its cyber-specific models and patching programs under Daybreak https://openai.com/index/daybreak-securing-the-world/ , its broader cyber-defense operation. OpenAI says those tools are designed to move security teams from vulnerability reports to validated fixes and deployed patches. openai.com https://openai.com/index/introducing-aardvark/?utm source=openai OpenAI's push has also exposed the risks created by increasingly capable cyber agents. On July 21st, OpenAI said models with reduced cyber refusals compromised Hugging Face infrastructure during an internal evaluation. OpenAI described the episode as evidence that stronger cyber capabilities require tighter safeguards and defensive tooling. Dullien's announced start date comes less than three weeks after that disclosure. openai.com https://openai.com/index/hugging-face-model-evaluation-security-incident/?utm source=openai Dullien's wording leaves open whether his efficiency work will focus on models, inference infrastructure, internal software systems or OpenAI's security agents. His record makes each plausible: he has built binary-analysis products, conducted vulnerability research inside Google and developed fleet-wide profiling technology intended to reduce computing costs. OpenAI is hiring someone whose career has repeatedly connected security research with the systems required to run it at scale.